Authentication

Every request needs an API key.

Pass your key in the X-API-Key header on every request:

X-API-Key: zpl_your_key

Managing keys

Create, name, revoke keys in the dashboard. Full key is shown once. Store it securely. Revokes are immediate.

Keep keys secret

Treat keys like passwords. Use server-side only, never client code or public repos. If leaked, revoke and create a new one.

Rate limits

Rate limits are account-wide per second by plan; per-key limits are secondary. Exceeding them returns 429 with a Retry-After header with seconds to wait. See Errors & Limits.